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SYSTEM AND METHOD FOR LIGHTING CONTROL NETWORK RECOVERY 

FROM MASTER FAILURE 



BACKGROUND OF THE INVENTION 
1- Field of the Invention 

This invention is related to recovering the ballast control in a wireless lighting control 
network when the main controller (master) fails. More particularly, this invention is related to a 
wireless lighting control network system and method in which all lighting ballasts act as backups 
for a network master control unit. Most particularly, this invention is related to a system and 
method for a master-slave architecture for a wireless lighting control network that include all 
lighting ballasts as backup for a network master control unit such that there is no need for 
reconfiguration of the network or human intervention when a master fails or functioning of the 
master or slave ballasts is interrupted. 



2. Description of Related Art 

Traditional lighting has wall switches wired to the ballasts individually or in groups. If 
one of the switches fails, the ballasts that are controlled by other switches won't be affected. In 
wireless control, the on/off or light intensity is controlled by the signals transmitted from a 
remote table-top or handheld control unit via infra-red (IR) or radio frequency (RF) 
communication media. 

There are basically two types of system configurations in wireless control. One is a 
distributed system that has several remote control units, each remote unit controlling a certain 
number of ballasts through the wireless links. The ballasts obtain the IDs of their designated 
controllers during the initialization of the system. Then, during normal operation the ballasts 



"listen", and react to the lamp operational signals coming transmitted by these controllers. The 
systems described in U.S. Patent No. 5,848.054 to Mosebrook et al. and U.S. Patent No. 
6,174,073 to Regan, fall into this category. 

The other type of system is a master-slave oriented networked architecture, which is the 
focus of this invention. There is one central device, so called "master" or "network coordinator" 
that manages communication among the network nodes. The ballasts and the remote controls 
both act as the slaves in the network. All the information about the wireless links between the 
keys on the remote control and the ballasts is gathered in a table stored in the master during initial 
configuration of the system. During the normal operation, the signal transmitted by a remote 
control is routed to its destination ballast by the master based on the link information in the table. 
The physical form of the master can be the same as a slave device, i.e. the master can reside in 
the remote control or the ballast. It is preferable to put the master in the ballast as it is mains- 
powered and at a fixed location. Connecting to the mains allows the master to transmit beacon 
packets that contain the master status information as a way to keep the slaves in touch every once 
in a while. Being at a fixed location avoids problems a missing handheld remote control since all 
the network information is lost in such a case. 

The master-slave networked system has the following advantages over the distributed 

system: 

• If more than one remote-control is needed in a multi-zone office, a separate master is 
essential for network recovery if a remote control is lost. 

• A master-slave architecture centralizes the control information for the local network 
and makes it easier to form the building-wide network. 



In both wireless systems, there could be several reasons for a system failure: 
• Power Loss: In normal operation, the ballasts should not be cut off from the 



• power for any reason, as they have to keep the RF communication alive all the time. 
Tuming-oflf the lamps only puts the lamp-drivers in stand-by in digital ballasts, and it 
does not shut off the power supply to the circuits. Sometimes the controller that 
happens to be installed on a different mains power line from the ballasts experiences 
a power outage. Other times flie controller could be running out of battery if battery 
powered. 

• Circuit malfunction : This includes circuit failures in the master control unit (MCU) or 
RF transceiver, and the temporary RF signal blockage/shielding or interference such 
that the communications between the devices are blocked. 

• Master Control Unit Failure : In a wireless network flie master control unit represents 
a single point of failure. That is, once the master fails, all link information kept only 
by the master is lost. In a point-to-point network the network is no longer operable. 
This also occurs because the master routes all the packets and the master fails. 

There are several ways to enhance the reliability. The wireless system taught by US Pat. 
No. 5,848,054 to Mosebrook et al., increases the reliability communications by adding repeaters 
between the source and destination devices. When the master and the ballasts suffer from 
intermittent communication in the direct path due to distance or RF interference, a repeater 
provides an additional communication path. However, this does not solve the problem of tiie 
master going completely dead. 

Another system, taught by EP0525 1 33 to Edwards et al., solves the master power outage 
problem by providing a battery as a back-up power source. When AC power is available, the 
battery is being charged. When the AC is cut off, the power supply automatically switches to the 
battery. Even though this idea teaches a battery backup for conventional hardwired lighting 
systems, it can be applied to the wireless system too. However, it can be costly to provide an 
additional power supply to every control device. 



In a master-slave networked system, due to the important role of the master, it is critical 
to make sure that there is always a master working properly at all times. If the controller fails due 
to a power outage (dead battery) or malfunction, the problem arises of to how to regain controls 
of the ballasts. New replacements can be brought in, but the configuration, such as which key to 
control which ballasts, has to be set up again since there is no hardwiring in a wireless control 
system. Depending on how the wireless control network is built in the first place, sometimes this 
may mean starting the configuration from scratch all over again. 

SUMMARY OF THE INVENTION 

The present invention solves the problems associated with a single master, as discussed 
above, by providing multiple back-up masters in a master-slave orientated control network. The 
system and method of the present invention enhances system reliability without an extra device or 
costly circuitry. Each ballast in the network has the potential to be a master when needed. This 
means each device needs a little bit of extra memory to store the master program. In a digital 
ballast, the cost for additional memory is minimal. 

The master malfunction is automatically detected by the slaves in the network. Once a 
master fails, a back-up master takes control of the network following a pre-established protocol 
or algorithm of a preferred embodiment. The network recovery takes place automatically and is 
transparent to the end user. There is no need to set up the network control configuration again. 

The original master resides in one of the ballasts after the installation and configuration of 
the network, which includes the physical installation, registration of the ballasts with the network 
master (so called "enumeration"), and associating the ballasts with certain buttons on the remote 
control (so called *T5inding"). 

All the ballasts (slaves in the network) have the possibility and capability of becoming 



die new.master if needed. It is randomly decided, when necessary, which ballast is the next 
back-up master. There is no priority number assigned before hand. 



BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 illustrates a flowchart of the back-up master operation taking over control of the 

network. 

FIG. 2 illustrates the failure of a network master control unit and several slaves of the 
same wireless lighting network. 

FIG. 3 illustrates recovery of a net>york master control unit from a power outage. 

DESCRIPTION OF PREFERRED EMBODIMENTS 

The wireless lighting control network functions analogously to a wireless communication 
network. The lighting network itself is identified by a network ID, which is the essential 
information for communication among all the network nodes and there is a several layer 
communication protocol stack associated with every component of the wireless lighting network. 
After the network is established by the master and an enumeration of the lighting elements and 
pairing of enumerated lighting elements with keys are done, the master has all the pairing 
information stored in a pairing-link table in the protocol stack. Each pairing-link table entry 
specifies which ballast(s) reacts to which key and on which remote control. The master transfers 
this pairing-link table to all the slaves in the network. Every time the pairing-link table is 
changed, the master keeps all the slaves updated. 



Master and slaves exchange status information at pre-determined intervals to make sure 
that the master is working properly. The master sends out beacon packets that contains status 
information at these certain intervals. The slaves receive the beacon packets and determine the 
state of the master. As illustrated in FIG. 1 , at step 1 1 slaves also wake up a master that is in its 
sleep mode at intervals //. Each slave keeps in touch with the master with the same interval but 
at a different point of time (based on a randomly generated number). 

Once a slave finds that the master is not working, at step 1 3 it waits a certain delay time t2 
before taking any action in case the master become operational again. Once the delay is timed 
out, at step 15 the first slave who discovers the master-failure will start to convert itself to the 
new master. While the first slave is waiting, the rest of the slaves can find out the master-failure 
too, but all of them have to wait for the same delay before reacting, so the first to discover the 
master outage becomes the new master. 

The new master switches to the master status using the master code that has already been 
stored in its memory. 

The new master establishes the network using the same network ID ttiat the previous 
master used, providing this network ID is not used by any other networks in the vicinity. Then 
the application layer of the master does the following, as shown in FIG. 1. 

1 . Informs the lower layers in the new master to act as a master (sending beacons. . .) 
using the same network ID. 

2. At step 1 5 informs the slaves that a new master is taking over the network and they 
should synchronize with the new master in terms of listening to the beacons and 
checking the master's status. 

3. At step 16 updates the pairing-link table and transmits a copy of it to all the slaves. 
The algorithm of the present invention can be implemented in combination with a 

wireless communication protocol, either proprietary or open standard to ensure a reliable RF 



communication such as Zigbee™. Zigbee™ is a low cost, low power consumption, two-way, 
wireless communications standard aimed initially at automation, toys, & PC peripherals, and is a 
good candidate for implementing this system and method of the present invention for a 
recoverable RF wireless lighting control network that uses slaves as backup masters. 
Normal Operation 

The very first time the system is installed, the master and slaves all take on the physical 
format of a ballast. In a preferred embodiment, their roles are distinguished by certain 
mechanisms or algorithms. In a given single room, there must be a master and at least one slave. 
All the devices, including master and slaves, have nonvolatile memories (NVM) to store the 
enumeration status information, network ID information and pairing-link table information. 
When the devices are initially powered up, the master checks its NVM to see if it has been in any 
network as a master before. If not, it establishes its network using a randomly generated network 
ID. The slaves check their NVMs to see if they have been in any network as a slave before, if 
not, they try to enumerate to a master available in their RF vicinity. Once they are connected to a 
master, tiie lamp flashes to provide feedback to the user and the user presses a button on the 
remote control to confirm that it should be included in the network. The remote control is also a 
slave to this network and has to be connected to the master before the ballasts. 

Reasons for Master Failure 

There are two major reasons for the master to fail: 

1 . Power Loss: During normal operation, both master and slave must not be cut offfrom 
the main power supply for any reason, as they have to keep the RF communication alive all the 
time. Turning off the lamps only puts the lamp drivers in stand-by, and it does not shut off the 
power supply to tiie circuits. When the ballasts are initially powered up from the main power 
supply, if a ballast is supposed to be a master, it starts to estabHsh its network. If it is supposed to 



be a slave, it starts to request joining a network. The ballasts store their IDs and network 
connection information (such as the pairing-link table, the flag indicating if it has been 
enumerated before, etc.) in the non-volatile memory so tfiat the network connection can be 
recovered after a temporary power interruption. If the power of the whole system is consistently 
interrupted, then the ballasts maintain their previous roles after the power comes back. In this 
case, the power-up reset does not trigger the enumeration request in the ballast if it was already in 
a network previously. This scenario is not considered a master failure since the whole network 
recovers to its previous state before the power interruption without ftirther procedures being 
invoked. 

However, sometimes the master could be installed on a different main power line fi-om 
the slaves. When its power is experiencing an outage and the one for the slaves is not, a back-up 
master is needed to keep the rest of the slaves under control. 

2. Circuit malfimction : This includes failures in tiie MCU or transceiver and temporary RF 
signal blockage/shielding around the master, etc. In this case, a back-up master is also necessary 
to recover the operation of all the slaves. 

FIG. 2 illustrates the master failure situation. If a circuit malfunction occurs and the 
network master control unit 22 is not functional, a new master control unit 28 takes over control 
of the existing lighting network by following the algorithm illustrated in FIG. 1. By way of 
example only, several slaves and a network master control unit 22 are shown in a non-working 
circuit in FIG. 2. The new network master control unit 28 takes control of the exiting lighting 
network 20, updates its pairing-link table to reflect these non-working units and transmits ttie 
updates to all the working slaves in the network. 
Disabled Master Coming Back 

In the case that the previous master recovers from its temporary RF blockage or power 
outage, it tries to join the same network again, but not as a master, instead, as a slave since there a 
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new master has already taken over control of the network. The following describes the two 
different situations where the previous master recovers from a temporary power outage and RF 
blockage. If the previous master failure is due to circuit malfunction, it cannot recover anyway. 
1- Coming back from temporary power outage 

Referring now to FIG.3, when the previous master regains power 3 1 , it goes through the 
power-up reset and then checks the contents of its NVM. When its NVM indicates that it was 
previously the master of a network 34, it tries to recover its role as master in the same networkby 
attempting to establish its network using the same network ID 34. It starts the search at this 
particular network identifier, and then listens for a beacon packet to see if anyone else is already 
using this network ID 35. As soon as it finds out that another device has already taken its place 
as the master in this particular network (using the previous network ID), it withdraws itself from 
attempting to become the master again, and it enumerates to the network as a slave 36. Since the 
network ID is still the same, it does not require any user intervention during the enumeration. 

As can be seen in FIG. 3, some of the slaves might have been out of power, as well, if 
they were on the same power line as the previous master. When they regain power, they go 
through power-up reset and then check the contents of their NVMs. As their NVMs indicate that 
they were was previously slaves of a network, they try to recover this role as a the slave 36, in the 
same network by attempting to enumerate using the previous network ID. The new master is able 
to accept them without user intervention since the new master has the information that the slave 
has been in this network before the power was out. 
2- Coming back from temp orary RF cnmmunication blockage 

When the previous master failure is due to the temporary RF communication blockage, 
the protocol stack is able to report this problem to the application layer. The application layer 
then goes back to the beginning of the routine, which is power-up reset. Then it keeps trying to 
re-establish its network using the same network ID 38. If. by the time the RF channel is clear for 



communication for this device, the new master has akeady taken over tfie network, the old master 
withdraws from trymg to become the master, but tries to become a slave, which is the same as the 
situation in coming back from temporary power outage and is discussed above and illustrated in 
FIG. 3.. If by the time the old master regains RF accessibility, \the new master has not yet taken 
control of the network, the old master recovers control over the same network with the same ID 
and this is illustrated in FIG. 3. 

Although the present invention has been described in relation to particular embodiments 
thereof, many other variations and modifications and other uses will be apparent to those skilled 
in the art. The present invention, therefore, should be limited not by the specific disclosure 
herein, but only by the appended claims. 
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